Rob--W / crxviewer

Add-on / web app to view the source code of Chrome / Firefox / Opera 15 extensions and zip files.
https://robwu.nl/crxviewer/
Mozilla Public License 2.0
1.43k stars 221 forks source link

Update get_crx_url to account for reduced UA entropy #129

Open Rob--W opened 1 year ago

Rob--W commented 1 year ago

crxviewer currently relies on navigator.userAgent to extract the version number to forward to the crx download endpoint: https://github.com/Rob--W/crxviewer/blob/e7ccd4f49d550e189e0d5a444790fffdc0065dc4/src/cws_pattern.js#L143-L153

As of today, the logic there is still relevant: The update server responds with 204 if the version is 31.0.1608.0 or lower. But if the version number is 32.0.0.0 or higher, the server happily accepts the request. This observation is relevant, because currently the logic forcibly falls back to version 9999.0.9999.0 if the major version is lower than 32, or if the build version is lower than 1609. Because navigator.userAgent has been reduced to something like 112.0.0.0, version 9999.0.9999.0 is used unconditionally, even though a lower version number would have been possible too. While there are APIs to get the full version number (i.e. the async navigator.userAgentData.getHighEntropyValues method), it may be sufficient to submit major.0.0.0 when the major version exceeds 31.

More info on User-Agent reduction in Chrome is available at: